about summary refs log tree commit diff
path: root/hosts/aptos/services.nix (unfollow)
Commit message (Collapse)AuthorFilesLines
2023-05-08modules/tahoe: remove duplicated declaration for user 'nas'Franck Cuny1-7/+0
2023-05-08modules/wireguard: move the module to the right locationFranck Cuny2-4/+4
2023-05-08profile/acme: default DNS provider is gandiFranck Cuny11-36/+64
Add the API key for gandi to the secrest, create a profile for acme with my defaults. The profile is loaded by tahoe since that's where our services are running on. Update all the servers in nginx to listen on their wireguard interface.
2023-05-08module for homelabFranck Cuny4-0/+23
2023-05-07home: get rid of mail / gpg modulesFranck Cuny7-172/+0
I don't use GPG anymore and I don't read mail in Emacs anymore.
2023-05-07profiles/workstation: move element (matrix client)Franck Cuny4-13/+2
2023-05-07profiles/laptop: more tweaksFranck Cuny1-1/+2
2023-05-06profiles/xps9300: add more settingsFranck Cuny3-2/+29
Coming from https://github.com/NixOS/nixos-hardware/blob/51559e691f1493a26f94f1df1aaf516bb507e78b/dell/xps/13-9300/default.nix
2023-05-06profiles/workstation: move sway to the workstation profileFranck Cuny6-36/+24
2023-05-06profiles/gtk: configure dark mode properlyFranck Cuny1-6/+2
Without this I was seeing the following error: ``` Unknown key Settings in /home/fcuny/.config/gtk-3.0/settings.ini ``` And the configuration contained: ``` [Settings] Settings=gtk-application-prefer-dark-theme=1 ```
2023-05-06profiles/laptop: set correct governor for tlpFranck Cuny1-2/+3
I was getting: ``` Error in configuration at CPU_SCALING_GOVERNOR_ON_AC="schedutil": governor not available. Skipped. ``` Restore to the previous configuration.
2023-05-06profiles/default: larger font on the console for all hostsFranck Cuny2-10/+10
Easier on my eyes.
2023-05-05home/profiles: move (almost) all modules to profilesFranck Cuny81-1530/+973
This is a major refactor, similar to what was done for the hosts, but in a single commit.
2023-05-02profiles/default: users are immutableFranck Cuny2-3/+3
2023-05-02profiles/server: move boot loader configurationFranck Cuny3-18/+9
2023-05-02profiles: consolidates common networking bitsFranck Cuny12-57/+26
This remove ssh on workstations. I also drop mosh since I don't use it.
2023-05-02profiles/default: move stuff related to bootFranck Cuny6-16/+16
2023-05-02profiles: move things around for btrfsFranck Cuny12-27/+26
2023-05-02profiles/hardware: create a few profiles related to hardwareFranck Cuny18-125/+29
2023-05-02profiles/default: move default packages thereFranck Cuny3-55/+45
2023-05-02profiles/default: more consolidationFranck Cuny10-89/+76
2023-05-02profiles/workstation: add font configurationsFranck Cuny4-46/+31
2023-05-02profiles: create default and serverFranck Cuny6-8/+28
The NAS and the router are "servers", and we create a base profile for them. We add a default profile that will set things that are common to all my hosts, and we start with the locales. Update tahoe/carmel to use the server profile.
2023-05-02profiles/workstation: consolidate sound related configurationsFranck Cuny5-40/+25
2023-05-01profiles/workstation: moved more things aroundFranck Cuny7-51/+18
2023-05-01profiles/laptop: consolidate services related to laptopFranck Cuny6-44/+14
2023-05-01profiles/workstation: reduce the number of moving partsFranck Cuny2-13/+14
There's too many moving parts and layers of abstractions, for no benefits: I only have to manage 3-4 machines. Going to create profiles, move things there, and stop with the `enable` pattern.
2023-04-30home/packages: rewrite scripts to use writeShellApplicationFranck Cuny2-19/+25
This function produces a shell script with dependencies, set the PATH, set some SHELLOPTS, and check the script with shellcheck.
2023-04-30home/packages: add a wrapper for restic on the nasFranck Cuny1-0/+16
This is to call restic on the nas from a remote machine. It sets variables and run everything via sudo.
2023-04-30modules/rclone: delete the module and cleanupFranck Cuny6-55/+1
I'm not using rclone anymore and I'm not storing the backups to GCS buckets either.
2023-04-30modules/security: move ssh configuration to a dedicated moduleFranck Cuny2-14/+19
2023-04-30hosts/tahoe: enable rsync-ing backups to rsync.netFranck Cuny3-0/+9
2023-04-30modules/backup: add a module for rsyncFranck Cuny2-0/+59
The NAS will rsync all the backups to rsync.net. This new module creates a systemd unit and timer to do this task.
2023-04-29modules/security: add ssh key for rsync.net to known hostsFranck Cuny1-0/+4
2023-04-29modules/boot: always clean up /tmp on bootFranck Cuny2-3/+1
2023-04-29modules/system: add ssh keys for known hostsFranck Cuny1-0/+10
These keys are stable, they can be set on every hosts.
2023-04-29hosts/tahoe: disable rcloneFranck Cuny1-1/+0
Backups are not synchronized with rclone to gcloud, but instead with rsync to rsync.net.
2023-04-29hosts/tahoe: update settings related to resticFranck Cuny1-14/+5
The path to the restic repository has changed, and we are a bit more specific about the paths we want to backup.
2023-04-29hosts/aptos: configure backups properlyFranck Cuny1-8/+16
Configure correctly the systemd unit to run restic on aptos. Be more specific about the paths we want to backup, instead of backing up '/home' and maintaining a large exclusion list.
2023-04-29modules/restic: handle extra options and remove unused settingsFranck Cuny1-11/+9
For a host to use a repository from a remote machine, we need to configure options for the CLI. For this we add a new setting `extraOptions` where we can define the sftp command. Remove the setting for the user that will run restic, since it's always 'root' in our situation. Clean some descriptions.
2023-04-29hosts/tahoe: rename account for backup and enable sftp for itFranck Cuny3-7/+21
The dedicated account for backup should be named 'backup', as it's more generic. While it's a system account, I still need to be able to log in the host remotely with sftp, so we give it a UID (991). The account needs to be able to sftp to tahoe in order to store the backups from remote hosts. However we don't want this user to get a shell and be able to browse the host, so we configure sshd to chroot the user to where the backups are stored.
2023-04-23hosts/aptos: do backups over sftp with a dedicated ssh keyFranck Cuny3-1/+10
2023-04-23modules/services: more cleanupFranck Cuny1-2/+0
2023-04-23modules/drone: clean this properlyFranck Cuny3-14/+0
2023-04-23hosts/tahoe: create a new user specifically for backupsFranck Cuny1-0/+11
This is the user I'll be using to do my backups. This is a system user, and there's only one public key added to it. This key is only used for backups and will be managed in this repository.
2023-04-23modules/services: delete unused servicesFranck Cuny6-326/+0
I'm not using anymore sourcegraph drone and gitea.
2023-04-23hosts/carmel: enable promtailFranck Cuny1-1/+5
2023-04-23modules/monitoring: set the host's name as a label for promtailFranck Cuny1-2/+2
2023-04-23hosts/tahoe: loki and prometheus listen only on the wg0 interfaceFranck Cuny4-11/+40
I don't want to have to deal with authentication and TLS certificates for these endpoints. If they are only listening on the wireguard interface I can trust that only authorized hosts are sending traffic to these endpoints. I trust what's running on these machines.
2023-04-23modules/monitoring: consolidate all monitoring services togetherFranck Cuny12-6689/+37
This will help to organize and structure monitoring modules a bit better.
2023-04-23modules/grafana: add loki as a source to grafanaFranck Cuny1-6/+13
2023-04-23modules/services: add loki and promtailFranck Cuny5-0/+178
2023-04-18nginx: remove the grafana dashboard providerFranck Cuny1-6/+0
This is now handled by https://git.fcuny.net/monitoring/commit/?id=b4abbf2d86d06d243b639d06a576f542f3dd5824
2023-04-15hosts/carmel: don't log dns queries in dnsmasqFranck Cuny1-1/+0
This is way too verbose
2023-04-15hosts/carmel: start dnsmasq once network interfaces are onlineFranck Cuny1-0/+7
2023-04-15hosts/carmel: don't release DHCP lease on wan interfaceFranck Cuny1-0/+3
No need to release the lease if we are rebooting.
2023-04-13home/alacritty: smaller fontFranck Cuny1-1/+1
2023-04-13home/shell: alias to show DHCP leasesFranck Cuny1-0/+1
2023-04-13modules/grafana: delete the dashboard for the routerFranck Cuny1-3784/+0
It's now managed in https://git.fcuny.net/monitoring/
2023-04-06hosts/carmel: serve the leases on port 8067Franck Cuny1-4/+7
Bind to the wireguard interface, and use the port 8067 (67 is the port used for DHCP requests).
2023-04-06hosts/carmel: run dnsmasql-to-html when leases changeFranck Cuny1-1/+4
The option `dhcp-script` can be used to run a script every time a new lease is added or deleted. We configure this option to run the script that generates a static HTML file with the leases.
2023-04-06tools/dnsmasq-leases-html: create a HTML page with leases from dnsmasqFranck Cuny6-1/+172
Parse the file that contains all the leases assigned by dnsmasq, and create a static HTML page from it. This can be served by nginx to make it easy to see what IP is assigned to a machine, and which machines are currently on the network.
2023-04-05monitoring: small fixesFranck Cuny2-1177/+0
2023-04-05hosts/carmel: the wireguard interface is trustedFranck Cuny1-1/+1
2023-04-05modules/prometheus: fix IP addressesFranck Cuny1-29/+7
2023-04-05wireguard: fix configuration of a few hostsFranck Cuny1-7/+2
2023-04-05hosts/carmel: add wireguard keyFranck Cuny4-2/+25
2023-04-05hosts/carmel: drop checkReversePathFranck Cuny1-3/+0
This is managed in the tailscale module.
2023-04-05hosts/carmel: enable tailscaleFranck Cuny1-0/+2
2023-04-03hosts/carmel: more options for dnsmasqFranck Cuny1-0/+2
2023-04-03hosts/carmel: add a few more options for dnsmasqFranck Cuny1-0/+6
2023-04-03hosts/carmel: enable prometheus exporter for DNSmasqFranck Cuny1-0/+5
2023-04-03hosts/carmel: reconfigure the host as a routerFranck Cuny14-118/+233
I'm not using it as a desktop, and the current router is getting old and will likely fail in the near future. It's also a debian machine configured manually, so let's reconfigure carmel as our new router. There are three NICs in the host: 2 are 10Gb and one is 1Gb. The 1Gb will be used as the upstream interface, and one of the 10Gb will be for the LAN. There are 2 VLANs to configure: one for IoT devices and one for guest.
2023-04-02flake: fix URL for sendsmsFranck Cuny2-7/+7
2023-03-31home/wayland: tweaks for mako and wofiFranck Cuny2-1/+7
2023-03-31home/sway: start sway and ssh-agent properlyFranck Cuny4-14/+20
I only need to run sway and the ssh-agent on a workstation (desktop or laptop). Start these two processes when the window manager starts.
2023-03-27modules/sendsms: gate the unit with a fileFranck Cuny6-6/+210
To prevent the unit to be triggered multiple times if the host has already rebooted, we create a gate file when we're done running, and before running, we check if the file exists. Enable the service on tahoe. Don't restart the unit when its definition has changed.
2023-03-26modules/console: fix syntaxFranck Cuny1-1/+1
2023-03-26modules/console: larger font for EVERYONEFranck Cuny2-9/+3
2023-03-26hosts/tahoe: set a larger font for the TTYsFranck Cuny1-0/+8
2023-03-19modules/cgit: get rid of double quotesFranck Cuny1-2/+2
2023-03-19home/matrix: switch back to elementFranck Cuny1-5/+1
fractal requires the gnome key chain but I got rid of it.
2023-03-18home/fonts: be more consistent in my choicesFranck Cuny4-9/+13
- source code pro for monospace - dejavu sans for sans serif - dejavu serif for serif
2023-03-15hosts: it's time to switch to schedutilFranck Cuny2-2/+4
2023-03-14home/sway: a bunch of small tweaksFranck Cuny3-16/+12
2023-03-14modules/fonts: add more fontsFranck Cuny1-3/+14
2023-03-14home/mpv: more configuration tweaksFranck Cuny1-0/+7
2023-03-14home/shell: a few more tweaks to zshFranck Cuny3-2/+5
2023-03-14hosts/tahoe: set the consoleMode to "max"Franck Cuny1-0/+3
2023-03-13home/git: some cleanupFranck Cuny3-17/+5
- add a comment for each ssh-key that is not stored on a yubikey - simplify the git commit template - remove some extra config that I don't need
2023-03-13home/passage: delete all references to password-storeFranck Cuny2-28/+5
I completely replaced the usage of `pass' with `passage'. There's no need to keep a mapping file at this point, since my interaction with the git server is through ssh.
2023-03-12home/alacritty: better (to me) colorsFranck Cuny1-0/+28
2023-03-12home/shell: aliases and cleaner promptFranck Cuny2-1/+2
2023-03-12home/yubikey: install (and run) yubikey-touch-detectorFranck Cuny1-1/+25
This is a useful tool to know when I'm supposed to touch my yubikey (sometimes I forget that some actions require that). Also configure a systemd unit to run it, and configure it to send a notification to the desktop (at the moment this is consumed by mako).
2023-03-12home/secrets: delete the one for gcloudFranck Cuny2-4/+1
Turns out I don't need this one!
2023-03-12tools: delete dns-updaterFranck Cuny7-882/+0
The code has moved to https://git.fcuny.net/dns-updater/
2023-03-11home/gpg: disable the agentFranck Cuny1-1/+1
I do not need an agent anymore, since I don't need to decrypt anything in GPG at this point!
2023-03-11home/yt-dlp: update configurationFranck Cuny1-1/+3
2023-03-11home/zsh: load ssh-agent before swayFranck Cuny1-1/+2
We need to start the ssh agent (if needed) before we start sway.
2023-03-11home/swaybar: add an indicator for systemd unitFranck Cuny2-3/+38
Reports the number of systemd units (user and systems) that are in failed state.
2023-03-11home/shell: switch the default shell back to zshFranck Cuny9-9/+49
I keep running into issues when using fish: I'm not familiar with the syntax and I don't use it enough that it sticks. I also need to google stuff regularly to figure out how things are supposed to work. This is annoying enough that the supposed benefits of fish are not worth it for me.
2023-03-11secrets: move aptos' gcloud secrets to homeageFranck Cuny4-8/+7
This secret is not needed system wide, I only need it to run some tools.
2023-03-11secrets: use homeage to manage secrets for home-managerFranck Cuny5-5/+47
Instead of using agenix for all the secrets, I can use homeage for secrets that are related to my user sessions. Secrets by default will be store under `~/.secrets'. They are encrypted using `age' and to decrypt them, a key is expected to be located under `~/.age/key.txt'. The last place where I was using `pass' (and so GPG too) was for the secrets for `mbsync': this change adds a secret for fastmail to the repository and update `mbsync' configuration to use it.
2023-03-10home/gnome: no more keyringFranck Cuny6-31/+2
I used the keyring only to start the GPG agent and unlock the ssh keys. But since I'm storing the ssh keys on yubikeys and I don't use GPG, I can remove it.
2023-03-10home/pass: configure passage properlyFranck Cuny1-15/+2
I need to be explicit about the path to the identity file. Since I'm switching from pass to passage, I also want to disable the automatic synchronization of the repository, and I don't need to have a wrapper for git to push the secrets (I push through ssh now instead of HTTPS).
2023-03-10documentation: clean upFranck Cuny3-68/+29
Delete gnome's keyring documentation, I will not be using it anymore, so no need to keep this around. Add documentation about how to manage secrets, and clean up wireguard's documentation.
2023-03-10hosts/tahoe: delete unused secretsFranck Cuny3-5/+0
2023-03-10hosts/tahoe: re-key all the secrets with age identitiesFranck Cuny12-32/+41
This is using the public keys from: - my user on my laptop - the root user on tahoe - the backup key stored on the USB drive
2023-03-10hosts/aptos: re-key all the secrets with age identitiesFranck Cuny6-18/+19
This is now using the public keys from various age keys: - one for my user on the laptop - one for the root user on the laptop - one backup key stored on the USB drive
2023-03-10modules/secrets: use age keys for agenix' identityFranck Cuny1-2/+5
I'll re-key all my secrets with age keys instead of using ssh keys. This change is to specify the path for the identities when agenix decrypts the secrets.
2023-03-10home/git: diff the content for age encrypted filesFranck Cuny2-0/+5
2023-03-04fix(home/wm): `programs.mako' has been renamed to `services.mako'Franck Cuny1-1/+1
See https://github.com/nix-community/home-manager/pull/3265
2023-03-04flake.lock: UpdateFranck Cuny1-726/+29
Flake lock file updates: • Updated input 'agenix': 'github:ryantm/agenix/5f66c8aa774d8d488cba1cdc4f0c954d2a14e3a1' (2023-02-20) → 'github:ryantm/agenix/1abf0ade92bdf9dbcaa5155bb39e3ae19cb98aaa' (2023-03-04) • Updated input 'emacs-overlay': 'github:nix-community/emacs-overlay/d7eeebd439b52b77958eb3d8043f3262701ddee2' (2023-02-20) → 'github:nix-community/emacs-overlay/2efd7c8d60ce0750097bbd327ec083e3ce545b31' (2023-03-04) • Removed input 'gh-ssh-keys' • Removed input 'gh-ssh-keys/crane' • Removed input 'gh-ssh-keys/crane/flake-compat' • Removed input 'gh-ssh-keys/crane/flake-utils' • Removed input 'gh-ssh-keys/crane/nixpkgs' • Removed input 'gh-ssh-keys/crane/rust-overlay' • Removed input 'gh-ssh-keys/crane/rust-overlay/flake-utils' • Removed input 'gh-ssh-keys/crane/rust-overlay/nixpkgs' • Removed input 'gh-ssh-keys/flake-utils' • Removed input 'gh-ssh-keys/nixpkgs' • Removed input 'gh-ssh-keys/pre-commit-hooks' • Removed input 'gh-ssh-keys/pre-commit-hooks/flake-utils' • Removed input 'gh-ssh-keys/pre-commit-hooks/nixpkgs' • Removed input 'gh-ssh-keys/rust-overlay' • Removed input 'gh-ssh-keys/rust-overlay/flake-utils' • Removed input 'gh-ssh-keys/rust-overlay/nixpkgs' • Updated input 'home-manager': 'github:nix-community/home-manager/72ce74d3eae78a6b31538ea7ebe0c1fcf4a10f7a' (2023-02-20) → 'github:nix-community/home-manager/b9e3a29864798d55ec1d6579ab97876bb1ee9664' (2023-03-02) • Removed input 'masked-emails' • Removed input 'masked-emails/crane' • Removed input 'masked-emails/crane/flake-compat' • Removed input 'masked-emails/crane/flake-utils' • Removed input 'masked-emails/crane/nixpkgs' • Removed input 'masked-emails/crane/rust-overlay' • Removed input 'masked-emails/crane/rust-overlay/flake-utils' • Removed input 'masked-emails/crane/rust-overlay/nixpkgs' • Removed input 'masked-emails/flake-utils' • Removed input 'masked-emails/nixpkgs' • Removed input 'masked-emails/pre-commit-hooks' • Removed input 'masked-emails/pre-commit-hooks/flake-compat' • Removed input 'masked-emails/pre-commit-hooks/flake-utils' • Removed input 'masked-emails/pre-commit-hooks/gitignore' • Removed input 'masked-emails/pre-commit-hooks/gitignore/nixpkgs' • Removed input 'masked-emails/pre-commit-hooks/nixpkgs' • Removed input 'masked-emails/pre-commit-hooks/nixpkgs-stable' • Removed input 'masked-emails/rust-overlay' • Removed input 'masked-emails/rust-overlay/flake-utils' • Removed input 'masked-emails/rust-overlay/nixpkgs' • Updated input 'naersk/nixpkgs': 'github:NixOS/nixpkgs/a1291d0d020a200c7ce3c48e96090bfa4890a475' (2023-02-19) → 'github:NixOS/nixpkgs/f5ffd5787786dde3a8bf648c7a1b5f78c4e01abb' (2023-03-03) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/0cf4274b5d06325bd16dbf879a30981bc283e58a' (2023-02-19) → 'github:NixOS/nixpkgs/96e18717904dfedcd884541e5a92bf9ff632cf39' (2023-03-02) • Updated input 'nur': 'github:nix-community/NUR/3c39aebcd09c9d6c257140e07f3d2beac4a83043' (2023-02-20) → 'github:nix-community/NUR/2860ab344d033a877e6a03f1c33cb4b7b5e05ddf' (2023-03-04) • Updated input 'pre-commit-hooks': 'github:cachix/pre-commit-hooks.nix/c9495f017f67a11e9c9909b032dc7762dfc853cf' (2023-02-20) → 'github:cachix/pre-commit-hooks.nix/382bee738397ca005206eefa36922cc10df8a21c' (2023-03-03) • Updated input 'rust': 'github:oxalica/rust-overlay/98f11700e398cf2ae6da905df56badc17e265021' (2023-02-20) → 'github:oxalica/rust-overlay/c25d3e1951863ac0061d47a3fabf9aa7c91db5e5' (2023-03-04) • Removed input 'sendsms' • Removed input 'sendsms/crane' • Removed input 'sendsms/crane/flake-compat' • Removed input 'sendsms/crane/flake-utils' • Removed input 'sendsms/crane/nixpkgs' • Removed input 'sendsms/crane/rust-overlay' • Removed input 'sendsms/crane/rust-overlay/flake-utils' • Removed input 'sendsms/crane/rust-overlay/nixpkgs' • Removed input 'sendsms/flake-utils' • Removed input 'sendsms/nixpkgs' • Removed input 'sendsms/pre-commit-hooks' • Removed input 'sendsms/pre-commit-hooks/flake-utils' • Removed input 'sendsms/pre-commit-hooks/nixpkgs' • Removed input 'sendsms/rust-overlay' • Removed input 'sendsms/rust-overlay/flake-utils' • Removed input 'sendsms/rust-overlay/nixpkgs' • Removed input 'x509-tools' • Removed input 'x509-tools/crane' • Removed input 'x509-tools/crane/flake-compat' • Removed input 'x509-tools/crane/flake-utils' • Removed input 'x509-tools/crane/nixpkgs' • Removed input 'x509-tools/crane/rust-overlay' • Removed input 'x509-tools/crane/rust-overlay/flake-utils' • Removed input 'x509-tools/crane/rust-overlay/nixpkgs' • Removed input 'x509-tools/flake-utils' • Removed input 'x509-tools/nixpkgs' • Removed input 'x509-tools/pre-commit-hooks' • Removed input 'x509-tools/pre-commit-hooks/flake-utils' • Removed input 'x509-tools/pre-commit-hooks/nixpkgs' • Removed input 'x509-tools/rust-overlay' • Removed input 'x509-tools/rust-overlay/flake-utils' • Removed input 'x509-tools/rust-overlay/nixpkgs'
2023-03-04ref: don't use my custom tools for nowFranck Cuny4-39/+3
I'm rewriting them in go and they are not ready to be used yet.
2023-03-03ref(templates): drop drone/GHA supportFranck Cuny4-113/+0
2023-03-03meta: convert README from org-mode to markdownFranck Cuny2-29/+40
2023-03-02ref(hosts/tahoe): don't install sendsmsFranck Cuny1-1/+0
It's not working as I want, let's fix it first then we can enable it again later.
2023-03-02ref(home/drone): remove droneFranck Cuny1-1/+0
It's not running anymore.
2023-03-02ci: remove drone's configurationFranck Cuny1-14/+0
drone is not running anymore
2023-03-02feat(hosts/tahoe): install gitolite and cgitFranck Cuny4-9/+145
Replace gitea with gitolite + cgit. I don't need a whole git forge for myself, especially since I don't use most of the features. The main thing I'm losing with this change is CI (via drone), but this is not really a big loss for now.